Main Vulnerability Database Vulnerabilities #VU56423

OS Command Injection in Cisco ASR 9000 Series Aggregation Services Routers and Cisco IOS XR - CVE-2021-34721

Published: September 9, 2021

Vulnerability identifier: #VU56423

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-34721

CWE-ID: CWE-78

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper input validation in the XML configuration manager of Cisco IOS XR Software. A local user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Affected software

Cisco ASR 9000 Series Aggregation Services Routers
Cisco IOS XR

How to mitigate CVE-2021-34721

Install updates from vendor's website.

Cisco ASR 9000 Series Aggregation Services Routers - addressed in versions 6.8.1, 7.4.1
Cisco IOS XR - addressed in versions 6.8.1, 7.3.2, 7.4.1

External References

Related Security Bulletins